openSUSE has issued an advisory on August 16: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N6TC5ZCUI72X4R5D7ZDQYSKDW4VVCUOE/ https://bugzilla.suse.com/show_bug.cgi?id=1199280
Maybe we do not ship this package in any of our offerings including Fedora,Epel. Closing this as NOTABUG.